APM reader user

edit

APM reader users typically need to view the APM app and dashboards and visualizations that use APM data. These users might also need to create and edit dashboards, visualizations, and machine learning jobs.

APM reader

edit

To create an APM reader user:

  1. Create a new role, named something like read-apm, and assign the following privileges:

    Type Privilege Purpose

    Index

    read on logs-apm*

    Read-only access to logs-apm* data

    Index

    view_index_metadata on logs-apm*

    Read-only access to logs-apm* index metadata

    Index

    read on metrics-apm*

    Read-only access to metrics-apm* data

    Index

    view_index_metadata on metrics-apm*

    Read-only access to metrics-apm* index metadata

    Index

    read on traces-apm*

    Read-only access to traces-apm* data

    Index

    view_index_metadata on traces-apm*

    Read-only access to traces-apm* index metadata

    Using the deprecated APM Server binaries? Add the privileges under the Classic APM indices tab above.

  2. Assign the read-apm role created in the previous step, and the following built-in roles to any APM reader users:

    Role Purpose

    kibana_admin

    Grants access to all features in Kibana.

    machine_learning_admin

    Grants the privileges required to create, update, and view machine learning jobs

Partial APM reader

edit

In some instances, you may wish to restrict certain Kibana apps that a user has access to.

  1. Create a new role, named something like read-apm-partial, and assign the following privileges:

    Type Privilege Purpose

    Index

    read on logs-apm*

    Read-only access to logs-apm* data

    Index

    view_index_metadata on logs-apm*

    Read-only access to logs-apm* index metadata

    Index

    read on metrics-apm*

    Read-only access to metrics-apm* data

    Index

    view_index_metadata on metrics-apm*

    Read-only access to metrics-apm* index metadata

    Index

    read on traces-apm*

    Read-only access to traces-apm* data

    Index

    view_index_metadata on traces-apm*

    Read-only access to traces-apm* index metadata

    Using the deprecated APM Server binaries? Add the privileges under the Classic APM indices tab above.

  2. Assign feature privileges to any Kibana feature that the user needs access to. Here are two examples:

    Type Privilege Purpose

    Kibana

    Read or All on the APM and User Experience feature

    Allow the use of the the APM and User Experience apps

    Kibana

    Read or All on Dashboards and Discover

    Allow the user to view, edit, and create dashboards, as well as browse data.

  3. Finally, assign the following role if a user needs to enable and edit machine learning features:

    Role Purpose

    machine_learning_admin

    Grants the privileges required to create, update, and view machine learning jobs